Introduction

We take the privacy and security of your personal data extremely seriously. At all times, we will comply with the prevailing laws and regulations governing confidentiality, data protection, and security of information, including the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

Personal data means any information that is about you or which can help identify you. This privacy policy explains how we use your personal data, your rights over your personal data, and how you can exercise them.

If you have any questions about this privacy policy or how we use your personal data, please contact us using the details provided at the end of this policy.

What Personal Data Do We Use?

In the context of providing lettings services to you, we will use the following information:

• Personal details such as your full name, current and previous addresses, address of rented properties, telephone numbers and email addresses
• For landlords, details of your rented properties including address, rental amount, and number of bedrooms
• Details of tenancies including agreed rental amount, deposit values, tenancy start date and duration
• Bank account details (account number and sort code)
• Personal data you submit or that is obtained from other parties to deal with disputes related to the tenancy

Where Do We Obtain Your Personal Data From?

We will collect your personal data in a number of ways. Much of the personal data we collect will be provided directly by you when you sign up for lettings services or when you contact us by email, letter, phone, or submit personal data online. We also generate payment, transaction and dispute resolution data as a function of providing a service to you.

We may also receive your personal data from the following third parties:

• A landlord or tenant
• The Land Registry to obtain details of properties and ownership
• Postal services
• Law enforcement or government agencies
• Solicitors

If you contact us via social media we may collect available details from your social media account. We may also collect information about you which can be obtained via open data sources and public records (e.g. the electoral register and information openly available via the internet), although we will only do this where it is necessary for the provision of services to you, where we have a legitimate interest in doing so, or where we have a legal duty in the investigation and prevention of money laundering and financial crime.

Third-Party Personal Data: You may also provide personal data to us about other individuals, such as tenants or other people connected to your tenancy. If you do this, you must confirm that the other person agrees you may share their personal data with us and that we may use it in accordance with this privacy policy.

Third-Party Service Providers

We use the following third-party service providers to help us deliver our services:

• Supabase (database and authentication services) - used to securely store and manage data for our secure admin dashboard (staff access only)
• Cloudflare (security services) - used to protect our website from malicious attacks and ensure secure access
• Arthur Online (property management system) - external tenant portal service where some tenants may access their tenancy information. This service is managed independently and has its own privacy policy

These service providers are carefully selected and are required to meet high data protection and security standards. When we share data with these providers, they process it only on our instructions and are subject to appropriate data processing agreements where applicable.

How We Use Your Personal Data

We use your personal data in the following ways:

• To validate your identity and identify you when you contact us
• To provide you services as outlined in the service terms and conditions
• To deal with requests you send us and respond to your queries
• To maintain your account and keep records of your tenancies
• To carry out your instructions in relation to your deposits and deposits held by third parties
• To provide alternative dispute resolution services
• To tell you about other related services and updates on policy changes
• To help us improve our services and analyse how people use our websites
• For trend analysis to help us develop and improve our products and services
• For profiling purposes to help us ensure you receive relevant information and services
• To contact you about other services and products we think may interest you (where you have provided consent)
• To comply with our legal and regulatory obligations
• To deal with complaints or legal claims
• To detect, prevent and report fraud and financial crime
• To investigate and prevent money laundering and financial crime
• To manage our business in an efficient and proper manner, including management of financial position, resources, and risk
• To authenticate and manage access to our secure admin dashboard (staff and authorized personnel only)

Our Legal Reason for Processing Your Personal Data

We may only use your personal data where we have a valid legal basis for doing so. The legal bases for us processing your personal data are:

• It is necessary for us to perform our obligations under a contract you have with us or to take steps at your request before entering a contract with us
• It is necessary for us to comply with a legal obligation to which we are subject
• You have given consent to processing for one or more specific purposes
• It is necessary for the purposes of legitimate interests pursued by us or by a third party, provided those interests are not overridden by your interests or your fundamental rights and freedoms
• It is necessary for us to comply with our legal obligations related to money laundering prevention and financial crime detection

How We Share Your Personal Data

We share your personal data with other companies in a number of ways to help us deliver services and meet our legal obligations.

Data Sharing to Provide Services

We may share your personal data with other companies to help us deliver services as follows:

• Other companies who help us administer our services
• Other companies who help us with marketing activities (where you have provided consent)
• Other companies who help us with administrative services, including mailing and IT services
• Other companies who provide dispute resolution services

Where we share your personal data with other companies to provide services to you, we ensure they have adequate safeguards to protect your personal data.

Other Data Sharing

We will also share your personal data in the following circumstances:

• Where we need to do so to comply with our legal or regulatory obligations, including sharing with regulators, auditors, government bodies, law enforcement agencies, or in connection with money laundering prevention and financial crime investigation
• In an effort to trace you if we lose contact with you
• Where necessary to protect or defend our legal rights or the legal rights of another party
• If our business or any part of it is transferred or sold, we will transfer your personal data to the company taking over our role, which could include a purchaser or the provider replacing us

We will never sell your information to anybody for unsolicited marketing.

International Data Transfers

Some of our service providers may process your personal data outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the UK Information Commissioner's Office
• Data processing agreements that meet UK GDPR requirements
• Service providers that have adequate data protection measures in place

We ensure that your personal data continues to receive adequate protection wherever it is transferred.

How Long We Keep Your Personal Data

We will keep your personal data for as long as necessary to provide our services to you and to meet our legal obligations. Retention periods vary depending on the type of data:

• Tenancy records: Retained for 6 years after the end of the tenancy (in line with tax and legal requirements)
• Financial records: Retained for 6 years after the end of the tax year (as required by HMRC)
• Correspondence and enquiries: Retained for up to 2 years after closure of your account or end of tenancy
• Property inspection records: Retained for the duration of the tenancy plus 6 years
• Login and authentication data: Retained for the duration of your active account

After these periods, we will securely delete or anonymize your personal data unless we are required by law to keep it for longer.

How We Protect Your Personal Data

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised or unlawful processing and against accidental loss, destruction or damage. These measures include:

• Secure authentication and access controls for our systems
• Encryption of sensitive data both in transit and at rest
• Regular security updates and monitoring of our systems
• Access to personal data restricted to authorised personnel only
• Regular backup procedures to prevent data loss
• CAPTCHA verification to prevent automated attacks

While we implement robust security measures, please note that no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but we continually work to protect your personal data.

Your Rights

Under UK data protection law (UK GDPR and Data Protection Act 2018), you have a number of important rights regarding your personal data:

• The right to be informed about how your personal data is being used (this privacy policy)
• The right to access personal data we hold about you (subject access request)
• The right to request correction of inaccurate or incomplete personal data
• The right to request deletion of your personal data (right to be forgotten)
• The right to restrict processing of your personal data in certain circumstances
• The right to data portability - to receive your personal data in a structured, commonly used format
• The right to object to processing of your personal data
• Rights relating to automated decision making and profiling

Please note that some of these rights only apply in certain circumstances, and we may not always be able to comply with your request (for example, if we have a legal obligation to retain your data).

How to Exercise Your Rights

If you wish to exercise any of your data protection rights, please contact us using the details below. We will respond to your request within one month, although in complex cases this may be extended by up to two months (we will inform you if this is necessary).

To help us process your request quickly, please provide:

• Your full name and contact details
• Details of the specific right you wish to exercise
• Any relevant information that will help us locate your data
• Proof of identity (if requesting access to personal data)

Cookies

Our website uses cookies to provide essential functionality and security. We do not use cookies for tracking, analytics, or advertising purposes. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically to stay informed about how we protect your personal data.

For significant changes that materially affect your rights, we will endeavour to notify you directly via email or through a prominent notice on our website.

Last Updated: January 2, 2026

Contact Us and Data Controller Details

If you have any questions about this privacy policy, how we handle your personal data, or wish to exercise your data protection rights, please contact us:

Data Controller: Wardill Lettings
Address: 9 Fullshaw Bank, Penistone, Sheffield, S36 6GB, UK
Email: helen@wardilllettings.com
Phone: +447930246655

Complaints to the Regulator

If you are not satisfied with our response to any data protection concern you raise with us, or you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection matters.

Information Commissioner's Office (ICO)
Website: www.ico.org.uk
Helpline: 0303 123 1113
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the opportunity to address your concerns before you contact the ICO, so please contact us first.